Dependency Scanning
Dependency scanning is a method that examines a project's direct and transitive third-party libraries, resolving their exact versions and checking them against known-vulnerability databases to flag insecure dependencies and recommend safe upgrades.
Applications pull in third-party libraries, and each of those libraries pulls in others, forming a deep dependency tree where most components are transitive (included indirectly). Dependency scanning walks this tree, reading manifest and lockfiles to determine exactly which packages and versions a build actually uses.
Each resolved dependency is checked against vulnerability sources such as the NVD and ecosystem advisory feeds. The scanner reports the affected package, the vulnerable version range, the severity, and, where available, the minimum fixed version, so a developer knows precisely what to upgrade. Good tooling distinguishes direct from transitive dependencies and handles version ranges accurately to avoid false alarms.
For developers, dependency scanning is a core part of keeping the software supply chain healthy, run in CI on every change so newly disclosed vulnerabilities in existing dependencies surface quickly. It is closely related to software composition analysis, which frames the same work alongside license compliance and inventory.